From 2fac997b618de07c6795127e4a03133f42c36590 Mon Sep 17 00:00:00 2001 From: Denis Arh Date: Thu, 26 Mar 2020 18:57:12 +0100 Subject: [PATCH] Fix script exec permission testing Explicity triggered scripts are no longer the only source of permissions - iterators use the same mechanisms --- pkg/corredor/service.go | 16 +++++++++------- pkg/corredor/service_test.go | 2 +- 2 files changed, 10 insertions(+), 8 deletions(-) diff --git a/pkg/corredor/service.go b/pkg/corredor/service.go index cb0f2ae9f..0179105bf 100644 --- a/pkg/corredor/service.go +++ b/pkg/corredor/service.go @@ -452,13 +452,6 @@ func (svc *service) registerServerScripts(ss ...*ServerScript) { // Corredor can (by design) serve us script with errors (load, parse time) and // they need to be ignored by security, trigger, iterator handlers if len(s.Errors) == 0 { - if sec, rr, err := svc.serverScriptSecurity(script); err != nil { - s.Errors = append(s.Errors, err.Error()) - } else { - s.Security = sec - svc.permissions = append(svc.permissions, rr...) - } - if s.Iterator != nil { // process iterator and register (deferred) event handlers if ptrs, err := svc.processIterator(s); err != nil { @@ -475,6 +468,15 @@ func (svc *service) registerServerScripts(ss ...*ServerScript) { } } + if len(s.Errors) == 0 { + if sec, rr, err := svc.serverScriptSecurity(script); err != nil { + s.Errors = append(s.Errors, err.Error()) + } else { + s.Security = sec + svc.permissions = append(svc.permissions, rr...) + } + } + if len(s.Errors) == 0 { svc.log.Debug( "script registered", diff --git a/pkg/corredor/service_test.go b/pkg/corredor/service_test.go index aaaf59986..21010303f 100644 --- a/pkg/corredor/service_test.go +++ b/pkg/corredor/service_test.go @@ -221,7 +221,7 @@ func TestService_canExec(t *testing.T) { svc.registerServerScripts(script1, script2, script3, script4) a.Len(svc.sScripts, 3) - a.Len(svc.permissions, 2) + a.Len(svc.permissions, 3) a.True(svc.canExec(ctx, script1.Name)) a.False(svc.canExec(ctx, script2.Name)) }